As a Salesforce admin, I worked on a banking management app. For that app, we created two profiles: employee and manager. As the manager holds a higher position, he has more access than employees. The requirement was that when the manager was on leave, we needed someone to be there on his behalf and manage the work assigned to him.
However, the employees can’t access some information on the manager’s profile because they don’t have permission to access it.
For that, we have a feature called permission sets in Salesforce, which gives additional access to users. Here, I explain why we need to assign permission sets to users instead of giving permissions from profiles, and then I will explain how to create permission sets and assign them to users in Salesforce.
Additionally, I will explain what a permission set group is in Salesforce and how to assign a permission set group in Salesforce.
Permission Sets in Salesforce
In Salesforce, a permission set is a collection of settings and permissions that gives additional access to users they already have from their profile without changing it. Using the permission set, we cannot remove the permission access that we have provided to the profile. We can only give extra access to users.
It allows administrators to extend specific permissions, such as access to objects, fields, and applications, to individual users or groups of users based on their roles in the organization.
Why Can’t We Give Additional Access to a User From the Profile?
For example, there are two profiles, employee and manager, with different permissions. The manager has more access than the employee profile user. When we grant additional access to a specific user from the employee profile, other users from the same profile will also gain access to the manager’s data. This will lead to a security or data privacy issue.
For that, we can create a permission set and give additional access to a specific user from the employee profile so that only that user can access the manager profile data.
Create Permission Sets in Salesforce
Here, we will create the permission set to provide additional user access. I explained how to create a permission set in Salesforce in the following steps.
Before Assigning Permission Set to the User
First, we will see why we need to assign a permission set to a user. Here, I logged in as the Manager Profile user, and they have access to the Customer Loan Object.
But when I log in from the Employee Profile user, you can see that they cannot access the customer loan object that the manager profile user can access.
Now, we will create a permission set so that this user can access that particular object.
1. To create a permission set, go to the Home Page in the quick find box, search for the Permission set, and click on it. Then click the New button to create a permission set.
2. Enter the Label, and the API Name will automatically populate. The description is optional. You can enter why you are creating this permission set.
As you click, the License field dropdown list will open, and you will see all Salesforce licenses there. You can select the licenses for which you are creating a permission set. If you choose a license, you can assign permission sets only to users under that particular license.
Once you select the license, you cannot change it. So, if you don’t want to choose a license, you can leave it as None. Then click the Save button.
Assign Permission Set to User in Salesforce
3. Now, we need to create this permission set to give users access to objects for which the manager profile user has permission.
To give the object access, click the Object Setting option.
4. Then search for the object for which you want to grant permission to another user. Here, I have selected the Customer Loan object. Then, give the permission that you want to access by another user and click the Save button.
5. After granting access, click the Manage Assignment button to assign the permission set to the user. If you select a license while creating the permission set and select a user not under that profile, you will get an error, as in the following image.
If you didn’t select any license, you can assign this permission set to any user.
6. For that, make sure you are selecting the user with the selected license. Then click the Next button.
7. Here, you will see two Expiration Options: no expiration date and Specify expiration date.
If you select the second option after the selected time period expires, this permission set automatically gets deactivated for selected users.
After choosing the expiration option, click the Assign button.
8. You will get a Success status if the permission set gets assigned to the user.
9. After assigning the permission set, log in with the user to whom you have assigned the permission set. Here, I assigned the permission set to the Employee Profile user.
10. As you logged in with that user here, you can see that before assigning the permission set, this user could not access the customer loan object, but now they can. Using the permission set, we can give access to a specific user without changing their profile.
As you log in with other users, even if they are from the employee profile here, you can see that they cannot access the customer loan object.
In this way, we can assign permission to the users so that they can get additional access to Salesforce.
Permission Set Group in Salesforce
In Salesforce, the permission set group is a feature that allows the assignment of multiple permission sets to a user or group of users with different roles in the org. These permission sets give the users of permission-set groups access to fields, features, and data in the system.
Permission set groups are useful for maintaining security and granting specific permissions to users without changing their profiles or roles.
Create Permission Set Group in Salesforce Lightning
To create a permission set group in Salesforce Lightning, navigate to the Setup page of Lightning and follow the steps below.
1. On Lightning’s Setup page, go to the Quick Find box, search for Permission set groups, and select Permission set groups under the heading Users.
2. In the permission set group’s setup window, click the New Permission Set Group button to create a permission set group.
3. In this step, enter the Label field with a relevant name to the Permission Set group. For example, I have entered the Label as a Sales permission set group.
The API Name field will be auto-filled according to the entered Label. Finally, click the Save button.
As we click on the Save button, the permission set group will be created.
4. Now, we will add permission sets to the created group. To do that, go to the section Permission Sets and click on Permission Sets in Group.
5. To add a permission set, click the Add Permission Set button.
6. Select permission sets from the Permission Set Label column by activating the checkboxes in the Action column. After selecting the sets, click on the Add button.
7. When we click on the Add button, the selected permission sets are added to the Permission set group. In this step, click on the Done button to apply changes.
With the above steps, we have successfully created a Permission set group in Salesforce Lightning. With this group, we can manage assignments and permissions in the org.
Limitations of Permission Set in Salesforce
We should be aware of some limitations to the permission sets in Salesforce so that we can use them more efficiently.
- We can only use the permission sets to grant access, and they can’t be used to revoke access.
- In a cloned Permission set, we cannot change the user license.
- In the Salesforce org. The limit to create Permission-set groups is 800, and the limit to create Permission sets is 1000.
- For file storage, 10 GB is allocated per org. If necessary, 1 GB of additional storage is allocated.
- If an organization has fewer than 10 users, it receives 1 GB of per-user file storage rather than a 100 MB per-user license.
Conclusion
I hope you have an idea about permission sets in Salesforce. In that, I have explained why we need to assign permission sets to users instead of giving permissions from profiles, and then I explained how to create permission sets and assign them to users in Salesforce.
Additionally, I explained what a permission set group is in Salesforce and how to assign a permission set group in Salesforce.
You may like to read:
- Assign Permission Set to the New User using Flow in Salesforce
- Assign Permission Sets using Data Loader in Salesforce
- List View Permissions Sets in Salesforce
- View All and Modify All Permissions in Salesforce
- Assignee does not have permission to view cases in Salesforce
I am Bijay Kumar, the founder of SalesforceFAQs.com. Having over 10 years of experience working in salesforce technologies for clients across the world (Canada, Australia, United States, United Kingdom, New Zealand, etc.). I am a certified salesforce administrator and expert with experience in developing salesforce applications and projects. My goal is to make it easy for people to learn and use salesforce technologies by providing simple and easy-to-understand solutions. Check out the complete profile on About us.
